UNIVERSITY OF GHANA

INTERNAL AUDIT DIRECTORATE

INTERNAL AUDIT CHARTER

February 2019

i | P a g e

Table of Contents

Page

Foreword ......................................................................................................................................... 1

1. General Provisions .................................................................................................................. 2

1.1 Introduction ...................................................................................................................... 2

1.2 Purpose, Authority & Responsibility ............................................................................... 2

1.2.1 Purpose of the Internal Audit Charter (The Charter) ................................................ 2

1.2.2 The University Council ............................................................................................. 3

1.2.3 The Vice-Chancellor ................................................................................................. 3

1.2.4 The Audit Committee ............................................................................................... 3

1.2.5 Director of Internal Audit ......................................................................................... 3

1.2.6 Organisational Structure ................................................................................................ 6

1.3 Approval & Amendments ................................................................................................ 7

2. Internal Audit Function ........................................................................................................... 7

2.1 Mission and Vision........................................................................................................... 7

2.2 Internal Audit Strategy ..................................................................................................... 7

2.3 Mandatory Guidance ........................................................................................................ 7

2.3.1 Value Preposition of the Internal Audit Directorate ..................................................... 8

2.3.2 Powers and Rights of the Directorate ........................................................................... 8

2.3.3 Delimitation of the Directorate ..................................................................................... 8

2.3.4 Types of Engagements .................................................................................................. 8

2.3.5 Code of Ethics .............................................................................................................. 9

2.3.6 Core Values ................................................................................................................ 11

ii | P a g e

3 Policies & Regulations .......................................................................................................... 12

3.1 Purpose of the Policies & Regulations ........................................................................... 12

3.2 Management of the Internal Audit Function .................................................................. 12

3.3 Orientation & Mentoring ................................................................................................ 12

3.4 Training & Development ............................................................................................... 13

3.5 Annual Audit Planning ................................................................................................... 14

3.6 Pre-Engagement Preliminary Activities ......................................................................... 15

3.7 Risk Assessment & Management ................................................................................... 15

3.8 Internal & External Collaboration .................................................................................. 17

3.9 Engagement Planning ..................................................................................................... 17

3.10 Entry Conference ........................................................................................................ 19

3.11 Fieldwork/ Performing the Engagement ..................................................................... 20

3.12 Audit Documentation & Working Papers .................................................................. 23

3.13 Evaluation and Review of Evidence ........................................................................... 24

3.14 Exit Conferences ......................................................................................................... 24

3.15 Audit Reporting .......................................................................................................... 25

3.16 Confidentiality ............................................................................................................ 26

3.17 Follow-up on Audit Recommendations ...................................................................... 27

3.18 Fraud Investigation ..................................................................................................... 28

3.19 Quality Assurance Improvement Programme ............................................................ 28

3.20 Pre-Auditing ............................................................................................................... 29

3.21 Mentoring Services ..................................................................................................... 30

4 Appendices ............................................................................................................................ 31

4.1 Definition of Terminologies ........................................................................................... 31

4.2 Templates ....................................................................................................................... 33

iii | P a g e

4.2.1 Audit Evidence or Procedure Documentation Form .................................................... 33

4.2.2 Code of Secrecy ...................................................................................................... 34

4.2.3 Competencies Review Form ................................................................................... 34

4.2.4 Ethical Review Form .............................................................................................. 34

4.2.5 Audit Time Sheet .................................................................................................... 35

4.2.6 Audit Finalisation Checklist ................................................................................... 35

4.2.7 Audit Recommendation Implementation Status Form ........................................... 36

1 | P a g e

Foreword

The University recognizes the Internal Audit Directorate as a strategic unit to promote

governance, assess risk management practices, and improve internal controls. An

organization is as good as the quality of its internal audit unit. The Statutes of the University

of Ghana highlight at Statute 8(1) that, “the University shall be managed and administered in

accordance with sound and internationally acceptable practices, benchmarks, principles and

ideas on university management and administration, including the principles of academic and

financial integrity, confidentiality, accountability, transparency, fairness and equality of

opportunity”.

As a result, this Internal Audit Charter has been developed and approved by Council to set

out the policies and procedures for carrying out the internal audit function of the University.

The Council of the University has approved the Charter and wishes to inform all employees

of its existence and that it must be complied with at all times. All officers and units shall in

accordance with the Charter and decisions of the Council, undergo internal audit processes in

strict adherence to the requirements stated therein. Thus, employees who contravene the

Charter will be considered to be in breach of their duties towards the University and Council,

and will be considered for disciplinary action. This will also apply to employees who are

aware of deliberate deviations from the Charter by others and become complicit by not

reporting their concerns or knowledge to the relevant University Authorities or any member

of Council.

Professor Ebenezer Oduro Owusu

Vice-Chancellor

February 15, 2019

2 | P a g e

1. General Provisions

1.1 Introduction

The University of Ghana was established under the provisions of the University of Ghana

Act, 1961 (Act 79) now repealed and replaced with the University of Ghana Act, 2010 (Act

806). The University is regulated by the University of Ghana Act, 2010 (Act 806) and the

Statutes enacted in accordance with the Act by the Council of the University. The internal

audit function is laid down in Statute 14 of Act 806. Section 16 of the Internal Audit Agency

Act, 2003 (Act 658) and Section 83 of the Public Financial Management Act, 2016 (Act 921)

stipulate the need to establish an internal audit function in a covered entity and the

responsibilities of such a unit. Section 2.4 (c) and Policy 1900 of the University of Ghana

Financial Regulation and Governance Manual also spell out the role of the Internal Audit

Directorate.

Consequently, this Charter has been developed to comply with the following:

i. University of Ghana Act, 2010 (Act 806).

ii. Internal Audit Agency Act, 2003 (Act 658).

iii. Public Financial Management Act, 2016 (Act 921).

iv. University of Ghana Financial Regulation and Governance Manual.

v. Guidelines for the Effective Functioning of Audit Committees in the Public Sector

of Ghana.

vi. International Standards for the Professional Practice of Internal Auditing

(Standards).

1.2 Purpose, Authority & Responsibility

1.2.1 Purpose of the Internal Audit Charter (The Charter)

The Internal Audit Charter is a formal document that defines the purpose, authority, and

responsibility of the Internal Audit Directorate of the University. The Charter establishes the

position of the Internal Audit Directorate within the University, including the functional and

administrative reporting relationship with Council and/or the Audit Committee and the Vice-

Chancellor. It authorizes access to records, personnel, and physical properties relevant to the

performance of engagements, and defines the scope of internal audit activities. The final

approval of the Charter resides with the Council.

3 | P a g e

1.2.2 The University Council

The Council is responsible for the strategic direction and governance of the University. In

relation to internal audit, the Council ensures that:

i. The right control environment is created.

ii. The Internal Audit Directorate is well resourced.

iii. The Internal Audit Directorate has a Director and the right leadership.

iv. The internal audit activity is carried out in compliance with relevant laws,

standards or code of best practices.

v. The Internal Audit Directorate receives the necessary support.

vi. The Audit Committee is established and functioning effectively.

1.2.3 The Vice-Chancellor

The Vice-Chancellor is responsible for:

i. Establishing an effective system of risk management, internal control and internal

audit in respect of the resources and transactions of the University.

ii. Reporting on the status of implementation of the recommendations of the Auditor-

General and those made by Parliament on findings of the Auditor-General and

recommendations of the Public Accounts Committee of Parliament.

1.2.4 The Audit Committee

The Audit Committee is responsible for ensuring that the Vice-Chancellor pursues the

implementation of any recommendation contained in:

i. The internal audit reports of the Internal Audit Directorate.

ii. Parliament’s decision on the Auditor-General’s report.

iii. Auditor-General’s and/or external auditor’s Management Letter.

iv. The report of any other internal monitoring unit of the University concerned

particularly with financial matters raised.

1.2.5 Director of Internal Audit

The Director of Internal Audit is the Chief Audit Executive of the University. The Director of

Internal Audit reports administratively to the Vice-Chancellor and functionally to the Audit

Committee. The Director of Internal Audit is responsible for:

4 | P a g e

i. Conducting skills gap assessment covering all aspects of the operations of the

Directorate to design, develop and implement a capacity building programme

involving both classroom and on-the-field training.

ii. Improving the existing structure of the Directorate and enhancing the ability of the

staff to perform assignments in line with the principles in the International

Professional Practices Framework (IPPF) as well as best practice.

iii. Designing, developing and implementing an Internal Audit Charter for the

University including standard working papers, tools and templates to help

improve the quality of the Directorate’s activities and deliverables.

iv. Using the manual to improve the existing audit approach and methodology and

train the staff of the Directorate to efficiently migrate to the new audit approach.

v. Collaborating with the Audit Committee, the Vice-Chancellor and Senior

Management to determine and agree on the University’s key strategic risks, and

develop a risk-based plan for the Directorate, as well as an operational plan for the

next financial year.

vi. Effectively executing the approved internal audit plan in line with the timelines in

the approved operational plan and submit regular status updates to the Audit

Committee.

vii. Presenting the results of internal audit reviews conducted during the period to the

Audit Committee and other relevant committees.

viii. Attending other Senior Management/Administrative meetings where appropriate

to discuss internal audit plans and activities, including significant weaknesses,

recommendations and status of corrective actions.

ix. Supervising the day-to-day activities of the Directorate.

x. Overseeing closure of audit findings and monitor implementation of key

initiatives arising from outcome of internal audit reviews.

Implementing a full Quality Assurance and Improvement Program (QAIP) to

enable an evaluation of the internal audit function’s conformance with the IIA

Standards, application of the Code of Ethics, assessing the efficiency and

effectiveness of the internal audit function and identifying opportunities for

improvement.

xi. Conducting special investigations as necessary.

xii. Regularly evaluating the adequacy and effectiveness of the University’s internal

control framework.

5 | P a g e

xiii. Assisting the Vice-Chancellor and the Council to establish effective fraud

prevention measures and provide initial or full investigation of suspected fraud.

xiv. Collaborating with other relevant units such as Finance to provide audit support

during the financial audit period and ensure that the findings from the financial

audit are regularly monitored and resolved.

xv. Reporting suspected fraud committed by the Vice-Chancellor and members of

Senior Management.

6 | P a g e

1.2.6 Organisational Structure

The chart below is the approved organizational chart for the operations of the Directorate.

Note: The SMC means Senior Management Committee which comprises of the Director, senior members and

audit leads.

7 | P a g e

1.3 Approval & Amendments

i. The Council shall approve the Charter on the recommendation of the University's

Audit Committee.

ii. The Audit Committee shall review the Charter at least on an annual basis.

iii. The Audit Committee shall be consulted on amendments to the Charter.

2. Internal Audit Function

2.1 Mission and Vision

The Directorate exists to provide an independent objective assurance and consulting services

to the University, designed to add value, improve risk management, governance, control

processes and operations, through systematic, proficient, disciplined and appropriate audit

approaches.

The Directorate operates with a vision to become a-must-use internal audit unit, for the

University and other institutions in Ghana and beyond, for assurance, consulting and

mentoring services.

2.2 Internal Audit Strategy

The Directorate will use the risk-based audit approach in all engagements from the

development of annual audit plans to audit execution and reporting. The Directorate will use

a decentralized audit strategy where audit teams will be assigned to the Colleges and Central

Administration of the University. Separate audit reports would be issued to the auditee and

then a consolidated audit report would be issued to the College for the attention of the

Provost. The reports of the Colleges and the Central Administration would be consolidated to

develop the audit report for the entire University for all related audit areas.

The Directorate would work to achieve the strategic priorities, objectives and key actions set

in its strategic plan. A revised strategic plan would be drawn up for subsequent years any

time a prior strategic plan expires and requires a major revision.

2.3 Mandatory Guidance

This section of the Charter deals with the Attribute Standards required of the Directorate.

8 | P a g e

2.3.1 Value Preposition of the Internal Audit Directorate

The Directorate is required by the Standards to provide independent, objective assurance and

consulting services designed to add value and improve the University’s operations. The

Directorate must help the University to accomplish its objectives by bringing a systematic,

disciplined approach to evaluate and improve the effectiveness of governance, risk

management and control processes.

2.3.2 Powers and Rights of the Directorate

Staff of the Directorate shall, in the performance of their duties, have the authority to:

i. Access University premises at a reasonable time.

ii. Access all assets, records, documents and correspondence relating to any financial

and other transactions of the University.

iii. Require and receive such explanations as are necessary concerning any matter

under examination.

iv. Require any employee of the University to account for cash, stores or any other

University property under his or her control.

v. Access records belonging to third parties, such as contractors, when required.

vi. Have their reports considered and recommendations implemented by appropriate

persons, bodies, committees and units of the University.

vii. Audit the accounts of all organizations required to submit financial statements to

the University.

2.3.3 Delimitation of the Directorate

In performing their work, staff of the Directorate shall have neither direct authority over nor

responsibility for any of the activities reviewed. Staff shall not develop and install

procedures, prepare records, make management decisions, or engage in any other activity that

could be reasonably construed to compromise their independence. Therefore, internal audit

reviews and appraisals do not, in any way, relieve other University personnel of their

assigned responsibilities.

2.3.4 Types of Engagements

The Directorate offers assurance, non-assurance and consulting services to the University and

other external organisations including the following:

9 | P a g e

i. Pre-Auditing

The Directorate will continue to handle pre-audit till the ethical and control

environment required from Finance staff is at the unquestionable assurance level.

ii. Post-Auditing

Post-audits (mainly assurance in nature) which form part of the Directorate’s annual

plan cover financial, compliance, operational, risk assessment, forensic/investigative,

performance audit, value-for-money audit and information technology audit.

iii. On-Demand/Request Auditing

The Directorate receives several requests for audits of projects, associations,

forensic/investigative, performance audit, value-for-money audit and other assurance

engagements from both internal and external stakeholders.

iv. Consulting Services

The Directorate is consulted by Senior Management and other staff of the University

on a broad range of issues. We are also represented on boards and committees at all

levels of the University.

v. Mentoring Services

The internal audit units of other state institutions, affiliated colleges and other

universities come to understudy the Directorate and seek its mentorship.

2.3.5 Code of Ethics

The Directorate shall adhere to all the fundamental principles proposed by the Institute of

Internal Auditors (Global and Local). All staff of the Directorate are required to abide by the

underlisted code of ethics.

i. Independence

The freedom from conditions that threaten the ability of the staff to carry out internal audit

responsibilities in an unbiased manner.

ii. Objectivity

An unbiased mental attitude that allows internal auditors to perform engagements in such a

manner that they believe in their work output and that no quality compromises are made.

Objectivity requires that staff do not subordinate their judgment on audit matters to others.

iii. Proficiency & Due Professional Care

Engagements must be performed with proficiency and due professional care. Staff must

possess the knowledge, skills, and other competencies needed to perform their individual

10 | P a g e

responsibilities. The Directorate collectively must possess or obtain the knowledge, skills,

and other competencies needed to perform its responsibilities.

Staff must apply the care and skill expected of a reasonably prudent and competent internal

auditor. Due professional care does not imply infallibility. In exercising due professional

care, staff must consider the use of technology-based audit and other data analysis

techniques.

iv. Confidentiality

Staff shall respect the value and ownership of information they receive and shall not disclose

information without authority unless there is a legal or professional obligation to do so. Staff

shall be prudent in the use and protection of information acquired in the course of their

duties. Staff shall not use information for any personal gain or in any manner that would be

contrary to any Act or Standard.

v. Continuing Professional Development

Staff must enhance their knowledge, skills, and other competencies through continuing

professional development.

vi. Conflict of Interest

Staff must not participate in any activity or relationship that may impair or is likely to be

taken to impair unbiased assessment, including an activity or a relationship that may be in

conflict with the interests of the Directorate.

vii. Gifts and Hospitality

Staff should not accept any gifts, rewards or hospitality (or have them given to members of

their families) from any organisation or individual with whom they have contact in the course

of their work, that would cause them to reach a position whereby they might be or might be

deemed by others to have been influenced in making a professional decision as a

consequence of accepting such hospitality. Staff shall not accept anything or any favour that

may impair or might be taken to affect their professional judgment.

viii. Courtesy and Consideration

Staff shall be respectful and regard the privacy and interest of others in the course of their

work. As far as it is possible, staff shall respect each other and endeavor to work in peace and

harmony.

ix. Reputation

Staff shall not knowingly be a party to any illegal activities or engage in acts that discredit the

work of the Directorate. Staff shall not demand or take a bribe, gratuity, recompense or

11 | P a g e

reward for the neglect, omission, commission or performance of duty. Staff shall not wilfully

fail to report any abuse or irregularity that comes to their notice in the course of the

performance of their duties or willfully suppress any information or explanation. Disciplinary

action shall be instituted against any staff for breach of this policy.

x. Quality Assurance Improvement Programme

The Directorate shall employ an ongoing and periodic internal and external assessment

approach to assess the efficiency and effectiveness of the internal audit activity and identify

opportunities for improvement.

2.3.6 Core Values

The Directorate shall be guided by core values which are consistent with the requirements of

the (IPPF) of the Institute of Internal Auditors and relevant Acts in Ghana. The core values

expected of every staff are:

i. Independence

The Directorate shall be independent, unbiased and objective in performing its work.

ii. Integrity

The Directorate shall demand the highest professional standards of staff to earn the

respect of others.

iii. Professionalism and Competence

The Directorate shall perform work for which it has the knowledge, skills and

competencies.

iv. Confidentiality

The Directorate shall respect the value and ownership of information and not disclose

information without authority unless there is a legal or professional obligation to do

so.

12 | P a g e

3 Policies & Regulations

3.1 Purpose of the Policies & Regulations

The objectives of the policies and regulations are to document the standards, guidelines,

and procedures to assist staff of the Directorate to provide the University with an

independent and objective assessment. In addition, the policies and regulations will help

staff to provide assurance to Council, Senior Management, Audit Committee and the

Internal Audit Agency of the quality of the University’s internal control, risk

assessment, governance processes, and make appropriate recommendations and

suggestions for continuous improvement.

3.2 Management of the Internal Audit Function

The Director of Internal Audit must effectively manage the internal audit activity to

ensure it adds value to the University. The internal audit activity adds value to the

University and its stakeholders when it considers strategies, objectives, and risks; strives

to offer ways to enhance governance, risk management, and control processes; and

objectively provides relevant assurance.

The internal audit activity is effectively managed when:

a. It achieves the purpose and responsibility included in the internal audit

Charter.

b. It conforms to the Standards.

c. Individual staff members conform to the Code of Ethics and the Core Values.

d. It considers trends and emerging issues that could impact the organization.

3.3 Orientation & Mentoring

Purpose

This policy will ensure newly appointed staff and interns are given adequate orientation

and all staff are effectively mentored to promote succession planning and the current

concerns of the Directorate.

Policies

i. All newly appointed staff shall undergo an orientation for one week.

ii. Audit leads and supervisors shall mentor team members and provide

appropriate leadership, review and supervision.

13 | P a g e

iii. Newly appointed Audit Leads and Supervisors shall undergo orientation and be

mentored by existing staff in those roles.

iv. The Senior Management Team may include the orientation and mentoring

needs of the Directorate on their agenda at least once every quarter.

3.4 Training & Development

Purpose

This provides the nature, extent and activities required to train and develop the

competencies of staff to deliver professional and quality service.

Policies

i. Staff with tendencies to be trained and developed would be engaged.

ii. Staff would be promptly and fairly promoted once they meet the criteria

contained in the conditions and scheme of service.

iii. Staff would be rotated on assignments and between the Colleges and the Central

Administration at least every two years.

iv. Staff appraisal will be effectively executed, training needs identified, and

training planned and budgeted for adequately.

v. Training needs identified from any external Quality Assurance Improvement

Assessment will be resolved by in-house and off-site workshops and

conferences.

vi. Every staff would be expected to attend at least two relevant and off-site CPDs

of their choice in a year, subject to availability of funds.

vii. The Directorate shall host an in-house training for all staff bimonthly at the

least.

viii. The Directorate shall sponsor at least four staff to attend the annual conferences

of the Internal Audit Agency, Institute of Internal Auditors (Ghana) and the

Institute of Chartered Accountants (Ghana).

ix. The Directorate shall budget for appropriate number of travel slots for staff to

attend the annual conference of the Institute of Internal Auditors (Global) and

other international internal audit conferences.

x. The Directorate shall sponsor staff to benefit from staff exchange programmes

with both local and external institutions based on availability of funding and the

Directorate would host inbound staff exchanges if required.

14 | P a g e

xi. Staff would be motivated with reduced workload and study leaves to pursue

relevant professional and higher qualifications. (Subject to the University’s

Training and Development Policy).

xii. Staff would be required to write reports, make available materials and teach

other staff on their return from trainings, conferences and exchanges.

xiii. The Directorate would procure the necessary software, equipment and resources

required to facilitate work and develop staff.

3.5 Annual Audit Planning

Purpose

This provides the requirement to develop an annual audit plan, get it approved,

monitored, performance-reviewed and reported to the Internal Audit Agency, Audit

Committee and the Vice-Chancellor.

Policies

i. The Director of Internal Audit has the responsibility to develop a flexible annual

audit plan using risk-based methodology, including any risks or control concerns

identified by management.

ii. The annual audit plan must be developed by identifying the risk profile of each

unit contained in the University’s Risk Register(s), requirements of Act 921,

findings and recommendations of the Auditor-General and/or external auditors,

input of Council, Vice-Chancellor, Audit Committee, other committees and

previous internal audit findings and recommendations and those of any other

monitoring unit.

iii. The draft annual audit plan must be ready by June 30th each year.

iv. The draft annual audit plan must be discussed within the Directorate at a general

staff meeting.

v. The agreed draft annual plan should be sent to the Vice-Chancellor for approval.

vi. The approved annual report should be tabled before the Audit Committee for

review and approval.

vii. The final approved and signed annual audit plan must be distributed to the Audit

Teams and a copy sent to the Internal Audit Agency before the new academic

year begins.

15 | P a g e

3.6 Pre-Engagement Preliminary Activities

Purpose

This provides the preliminary or initial activities expected of staff on an assigned

engagement.

Policies

i. The audit lead must ensure that each team member has completed the ethical

compliance and competencies form to determine the suitability of the person on

the team.

ii. Any person who fails the above test, shall be reassigned another task they are fit

to perform.

iii. If the area has previously been audited, a copy of the previous audit report and

copies of the permanent files shall be obtained from the audit file for the

area/auditee.

iv. Staff may have a discussion with the previous person who conducted the audit to

gain greater understanding, assess risk and decide on audit procedures to adopt.

v. Staff must inspect the risk register of the auditee to confirm, amend or change

the key issues to be examined in the audit.

vi. Staff must retrieve the Integrated Tertiary Software (ITS) report for the audit (if

applicable).

vii. Staff must use the recommended data analytic tool (e.g. the IDEA software) to

assess risk, conduct analytical procedures and draw preliminary understanding

of the audit.

viii. A copy of the report in the above guidelines must be kept as a working paper.

ix. Staff must document in writing their understanding of the audit and the key

issues to be raised.

x. Where applicable, a copy of the agreement or documentation on the audit must

be obtained, studied, documented and a copy of the write-up and said document

filed.

3.7 Risk Assessment & Management

Purpose

This provides guidelines on risk assessment and management, and procedures to

evaluate effectiveness and to contribute to the improvement of risk management

processes of the University.

16 | P a g e

Policies

i. Staff must assess the effectiveness of risk management by units of the

University by considering how the unit:

a) aligns its organizational objectives with and, supports the University’s

mission.

b) Identifies and assesses significant risks.

c) Selects appropriate risk responses and aligns risks with the

University’s risk appetite.

d) Captures and communicates relevant risk information in a timely

manner across the University, enabling staff, Senior Management,

and the Council to carry out their responsibilities.

ii. Staff must request and inspect the risk register of the auditee and inquire about

the risk management practices.

iii. Staff must liaise with the Chief Risk Officer if necessary to appreciate risk

management issues likely to affect the audit.

iv. Staff must evaluate risk exposures relating to the University’s governance,

operations, and information systems regarding the:

a) Achievement of the University’s strategic objectives.

b) Reliability and integrity of financial and operational information.

c) Effectiveness and efficiency of operations and programs.

d) Safeguarding of assets.

e) Compliance with laws, regulations, policies, procedures, and contracts.

v. In every audit, staff must evaluate the potential for the occurrence of fraud and

how the University manages fraud risk.

vi. During consulting engagements, staff must address risk consistent with the

engagement’s objectives and be alert to the existence of other significant risks.

vii. Staff must incorporate knowledge of risks gained from consulting engagements

into their evaluation of the University’s risk management processes.

viii. When assisting management in establishing or improving risk management

processes, the Directorate must refrain from assuming any management

responsibility by actually managing risks.

17 | P a g e

3.8 Internal & External Collaboration

Purpose

This provides the guidelines and mindset required of staff pertaining to expected

collaborations which could affect the nature, extent and timing of audit procedures.

Policies

i. The Director of Internal Audit should share information, coordinate activities,

and consider relying upon the work of other internal and external assurance and

consulting service providers, to ensure proper coverage and minimize

duplication of efforts.

ii. The Directorate must work cordially and share information with the Chief Risk

Officer of the University.

iii. The Directorate must collaborate and share information with the external

auditors and obtain a copy of the annual management letter.

iv. The Directorate must collaborate with heads of units to understand their audit

needs.

v. The Audit Implementation Follow-up Teams must work closely with the

Finance Directorate, University of Ghana Computing Systems (UGCS) and

other units of the University.

vi. The Directorate must strive to earn the trust and confidence of both internal and

external whistleblowers.

However, such collaboration must not impair independence, lead to suppression of

findings, victimization or avoidance of certain assignments to protect any staff of the

University.

3.9 Engagement Planning

Purpose

This provides the minimum factors to be considered at the planning stage of each

engagement to ensure the development of a risk-based audit plan and the possible

achievement of an effective audit performance outcome.

Policies

i. Staff must develop and document a plan for each engagement, including the

engagement’s objectives, scope, timing, and resource allocations.

18 | P a g e

ii. Staff must request must consider the University’s and/or unit’s strategies,

objectives, and risks relevant to the engagement.

iii. Staff, in planning the engagement, must consider:

a) The strategies and objectives of the activity being reviewed and the

means by which the activity controls the unit’s performance.

b) The significant risks to the activity’s objectives, resources, and

operations and the means by which the potential impact of risk is kept to

an acceptable level.

c) The adequacy and effectiveness of the activity’s governance, risk

management, and control processes compared to a relevant framework or

model.

d) The opportunities for making significant improvements to the activity’s

governance, risk management, and control processes.

iv. Staff, in planning an engagement for parties outside the organization, must

establish a written understanding with the party about objectives, scope,

respective responsibilities, and other expectations, including restrictions on

distribution of the results of the engagement and access to engagement records.

v. Staff must establish an understanding with consulting engagement clients about

objectives, scope, respective responsibilities, and other client expectations. For

significant engagements, this understanding must be documented.

vi. Staff must establish the objectives for each engagement.

vii. Staff must conduct a preliminary assessment of the risks relevant to the activity

under review. Engagement objectives must reflect the results of this assessment.

viii. Staff must consider the probability of significant errors, fraud, noncompliance,

and other exposures when developing the engagement objectives.

ix. Staff must establish the scope of the audit at the planning stage.

x. The established scope must be sufficient to achieve the objectives of the

engagement.

xi. Staff must determine appropriate and sufficient resources to achieve engagement

objectives based on an evaluation of the nature and complexity of each

engagement, time constraints, and available resources.

xii. The constitution of the audit team for the engagement must be finalised at this

stage.

19 | P a g e

xiii. Staff must develop and document work programs that achieve the engagement

objectives.

xiv. Work programs must include the procedures for identifying, analyzing,

evaluating, and documenting information during the engagement.

xv. The work program must be approved prior to its implementation, and any

adjustments approved promptly.

3.10 Entry Conference

Purpose

This provides guidelines on procedures required for an entry conference for an

engagement, to promote an effective cooperation from the unit/auditee and achieve a

value-added audit outcome.

Policies

i. An entry conference must be held for all engagements to gather information

about the mission, vision, critical processes, and control procedures of the unit.

ii. The Audit Team must notify the unit/auditee about the entry conference via

email or memo and the notice must specify the purpose, agenda, date, time,

venue and the persons to be present for the meeting.

iii. The following issues, at least, must be discussed and/or included during the

entry conference meeting:

a. The Terms of Reference of the engagement.

b. The audit focus.

c. The purpose of an audit and how audits help improve the University’s controls

and operations.

d. Review of the objective(s) and scope of the audit by encouraging management

of the unit to discuss any aspect of the audit.

e. Ask for suggestions of potential auditee problem areas within the audit scope.

This communicates an intention of being helpful rather than critical.

f. Determine what assistance from personnel other than those attending the

opening conference is needed to answer detailed questions concerning the

functions to be performed. Contact should be made via the "Chain of

Command" until an understanding with the appropriate person is established.

20 | P a g e

g. Explain how audit concerns (observations) are handled. Explain that concerns

will be reviewed with the designated auditee at the time they arise and identify

who will be responsible for reviewing the audit concerns.

h. Explain that the purpose of discussing each audit concern is to verify that both

the facts defined in the concern and the impact of the concern are accurate.

Some findings may be resolved verbally.

i. Establish how frequently the head of the unit/auditee wants to be updated on

audit progress and findings.

j. Explain that they will review the draft audit report in detail at the exit

conference.

k. Explain that a copy of the final audit report will be sent to their reporting line

up to and including Senior Management, Audit Committee and other relevant

persons.

l. Inquire about working hours, working area, access to records, and any other

information that details the office routines. This information may have

considerable influence on the cooperation extended to the audit staff.

m. Identify information needed to complete the audit procedures.

n. Establish a tentative schedule for the audit process.

o. Ask if there are any questions concerning anything discussed at the opening

conference or any questions in general about the auditor or audit approach that

will assist the auditees in their understanding of the engagement.

p. Inquire of any areas within their operations that they feel are more susceptible

to fraud or over which they have concerns.

q. Ask about any fraudulent activity that has occurred in the unit within the last

two years.

r. Inquire about how risk is managed and obtain copy of the risk register.

s. Minutes must be taken, included as part of the working papers and circulated

to those present at least a week after the meeting.

3.11 Fieldwork/ Performing the Engagement

Purpose

This provides guidelines for fieldworks and procedures to adopt to obtain sufficient and

appropriate evidence to serve as the basis for the audit opinion.

21 | P a g e

Policies

i. Staff must identify, analyze, evaluate, and document sufficient information to

achieve the engagement’s objectives.

ii. Staff must identify sufficient, reliable, relevant, and useful information to

achieve the engagement’s objectives.

iii. Staff must base conclusions and engagement results on appropriate analyses and

evaluations of evidence.

iv. Staff must document sufficient, reliable, relevant, and useful information to

support the engagement results and conclusions.

v. Engagements must be properly supervised at each stage to ensure objectives are

achieved, quality is assured, and staff is developed.

vi. Each staff must be assigned specific tasks for each stage of the engagement, they

must be notified and briefed accordingly, and this must be documented.

vii. The Audit Observation Form must be used to document all audit observations or

issues.

viii. A separate sheet or page must be used for each of the observations or issues and

included in the working papers with copies of the supporting documents.

ix. The Audit Observation Form should be used whenever there is a possible:

a) opportunity for operational improvement

b) discrepancy

c) error

d) irregularity

e) weakness or

f) deviation from UG Financial Regulation and Governance, best practice

internal control standards, regulations, or laws.

x. The main sections to be indicated on the Audit Observation Form are:

a) The Criteria

b) The Condition

c) The Cause

d) The Implications

e) Recommendations

f) Initial Response of the auditee (if any).

xi. During the course of the audit, conditions may arise which warrant revising the

audit procedures, scope, or budgeted hours. The staff should evaluate the

22 | P a g e

situation, make timely recommendations to the audit lead, and obtain approval

before incorporating any changes.

xii. Staff may use any or combination of the following audit procedures for an

engagement:

a) Inspection of records or assets

b) Inquiry

c) Observation

d) Analytical procedures

e) Recalculation

f) Reperformance

g) External confirmations

h) Walkthrough test

i) Management response

xiii. The audit evidences or procedures for the entire engagement may be

documented by using the format shown in the appendix (4.2 Template).

xiv. The following procedures may be employed:

a) Gaining an understanding of the activity, system, or process under review

and the prescribed policies and procedures; supplementing and continuing

to build upon the information already obtained in the risk assessment

process.

b) Observing conditions or operations.

c) Interviewing people.

d) Examining assets and accounting, business, and other operational records.

e) Analyzing data and information.

f) Reviewing systems of internal control and identifying internal control

points.

g) Evaluating and concluding on the adequacy (effectiveness and efficiency)

of internal controls.

h) Conducting compliance testing.

i) Conducting substantive testing.

j) Determining if appropriate action has been taken regarding significant

audit concerns and corrective actions reported in prior audits.

23 | P a g e

3.12 Audit Documentation & Working Papers

Purpose

This provides guidelines for working papers and audit documentation to promote audit

reviews, quality control and attest that sufficient and appropriate evidence has been

obtained.

Policies

i. Staff must maintain sufficient and appropriate working paper and documentation

for each engagement.

ii. The conclusions and the reasons for how those conclusions were reached must

be documented.

iii. The disposition of each audit observation identified during the audit and its

related corrective action should be documented on an Audit Observation Form.

iv. Working papers should be completed throughout the audit by the assigned staff.

v. Working papers must be reviewed by the audit lead and the audit supervisor.

vi. Working papers should be concise, clear and understandable.

vii. Audit documentation must record only what is essential; and they should ensure

that each working paper included serves a purpose that relates to an audit

procedure.

viii. Working papers that are created and later determined to be unnecessary may be

deleted.

ix. The working papers to be documented for each engagement might include:

a) Planning documents and audit procedures

b) Controls questionnaires, flowcharts, checklists, and narratives

c) Notes and minutes resulting from interviews

d) Organizational data, such as charts and job descriptions

e) Copies of important documents

f) Information about operating and financial policies

g) Results of control evaluations

h) Letters of confirmation and representation

i) Analysis and test of transactions, processes, and account balances

j) Results of analytical review procedures

k) Audit reports and management responses

l) Audit correspondence that documents the audit conclusions reached.

24 | P a g e

x. An experienced auditor reviewing the working papers, should be able to identify

what he/she sets out to do, what was done, what was found, and what was

concluded on.

xi. Scanned or photocopied documents should include a reference to the source, and

the purpose of the document when relevant to understanding or appreciating the

actual audit work performed.

xii. Working papers can be either soft or hard copies. Soft copies must be kept in a

well labelled folder for easy identification and backed-up on an external drive.

3.13 Evaluation and Review of Evidence

Purpose

This provides guidelines for review of evidence to promote audit quality.

Policies

i. The terms of reference for each engagement shall be reviewed and approved by

the Director of Internal Audit.

ii. The engagement plan shall be reviewed by the Director of Internal Audit.

iii. Audit leads shall review and evaluate the evidence gathered by their team

members.

iv. The Director of Internal Audit shall review and evaluate evidence contained in

the working papers before the draft audit report is issued.

v. The adequacy and sufficiency of working papers and audit documentation shall

be reviewed by the Director of Internal Audit.

3.14 Exit Conferences

Purpose

This provides guidelines for the conduct of exit conference to improve cooperation and

create appropriate control environment to implement audit recommendations.

Policies

i. The audit team must use an exit conference to avoid any misunderstandings or

misinterpretations of fact by providing the opportunity for the auditee to clarify

specific items and to express views on the corrective action and other

information presented in the draft report.

ii. The invitees should include the audit participants and the Head of the Unit.

25 | P a g e

iii. The Audit Lead should contact audit participants to determine a suitable time

and location for the exit conference.

iv. At a minimum, the audit team should be prepared to discuss the audit including

what they did (objective, scope, procedures), what risks were perceived, how

they anticipate the corrective action will address the associated risk, and other

concerns identified in the audit supported by the Audit Observation Forms.

v. Changes suggested by the auditee at the exit conference require review by the

audit lead.

vi. If additional wording changes are needed, a revised draft will be provided to the

auditee.

vii. If the auditee is in agreement with the wording and recommendations, the audit

lead should obtain the auditee's signature on the draft report at the exit

conference.

viii. If the auditee is not in agreement with the finding and/or recommendation, the

audit would continue to seek an agreement through the unit’s reporting line up to

the Director of Internal Audit.

ix. If the auditee, to whom the report is being directed, does not accept the

recommendation or is unwilling to accept the risk of implementing the

recommendation, the audit lead must report the finding and the related risk

within the final report.

x. If revisions are made to the draft report after the exit conference, the revised

draft should be sent to the auditee and agreement with those changes should be

obtained via signature or email prior to issuance of the report.

3.15 Audit Reporting

Purpose

This provides guidelines for audit reporting to promote quality assurance and audit

impact.

Policies

i. The Director of Internal Audit is responsible for issuing the final audit report to

parties who can ensure that the results are given due consideration.

ii. All audit report must conform in all material respect to the audit report template.

26 | P a g e

iii. Final communication of engagement results must include applicable

conclusions, as well as applicable recommendations and/or action plans.

iv. The opinion should be clearly stated.

v. Audit report must be accurate, objective, clear, concise, constructive, complete,

and timely.

vi. If a final audit report contains a significant error or omission, the Director of

Internal Audit must communicate corrected information to all parties who

received the original report.

vii. When releasing engagement results to parties outside the organization, the

communication must include limitations on distribution and use of the results.

viii. The Vice-Chancellor and the Audit Committee must be issued copies of all audit

reports except in exceptional request audits.

ix. Copies of audit reports would be sent to the Internal Audit Agency and/or the

Auditor-General (if applicable) as required by Act 658.

x. The Director of Internal Audit shall speak to audit reports in any meeting if

required.

3.16 Confidentiality

Purpose

This provides guidelines on the confidentiality required of staff to promote acquisition

of evidence and foster cooperation from all staff of the University.

Policies

i. Staff shall respect the value and ownership of information they receive and shall

not disclose information without authority unless there is a legal or professional

obligation to do so.

ii. Staff shall be prudent in the use and protection of information acquired in the

course of their duties.

iii. Staff shall not use information for any personal gain or in any manner that

would be contrary to this Charter or detrimental to the legitimate and ethical

objectives of the University.

iv. Any other dissemination of working papers or correspondence contents must be

approved by the Director of Internal Audit.

27 | P a g e

v. All paper documents generated in the course of performing audit work to be

disposed of must be shredded.

vi. The following standard e-mail disclaimer must be used for all official messages

sent by any staff:

“This electronic mail message and any attached files contain information

intended for the exclusive use of the individual or entity to which it is addressed

and may contain information that is proprietary, privileged, confidential and/or

exempt from disclosure under applicable law. If you are not the intended

recipient, you are hereby notified that any viewing, copying, disclosure or

distribution of this information may be subject to legal restriction or sanction.

Please notify the sender, by electronic mail or telephone, of any unintended

recipients and delete the original message without making any copies”.

vii. Access to audit reports and management communications is restricted to only

authorized audit staff.

viii. All efforts should be made to keep reports protected from the public and users

who are not expected to see them.

ix. Audit reports should not be voluntarily disclosed outside of the University and

should only be released at the express direction of the Vice-Chancellor or upon

presentation of a valid court order.

x. All staff shall be made to sign a Code of Secrecy on the first day of employment

and the signed code put on their staff file.

xi. All current staff shall sign the Code of Secrecy on the first day this Charter

comes into effect.

3.17 Follow-up on Audit Recommendations

Purpose

This provides the guidelines for carrying out follow-ups of recommendations to

promote their implementation and eliminate any control weaknesses.

Policies

i. The Director of Internal Audit must establish and maintain a system to monitor

the disposition of audit recommendations to management.

ii. The Director of Internal Audit must establish a follow-up process to monitor and

ensure that management actions have been effectively implemented or that

senior management has accepted the risk of not taking action.

iii. Where applicable, all audit reports must include a section on the status of

implementation of prior audit and other recommendation.

28 | P a g e

iv. The Director of Internal Audit must issue a quarterly report to the Audit

Committee on the status of implementation of both internal and external audit

recommendations.

v. The Audit Recommendation Implementation Status Form shall be used.

3.18 Fraud Investigation

Purpose

This provides guidelines for fraud investigation to promote an effective audit.

Policies

i. The Directorate will operate an open whistle-blowing culture across the

University for employees, students and external stakeholders to provide

information on fraud.

ii. Fraud shall be investigated as soon as it is known or suspected.

iii. The Directorate may collaborate with other units or bodies within or outside the

University to investigate fraud.

iv. Staff must test for fraud in all engagements.

v. Fraud perpetrated by the Vice-Chancellor shall be reported to the Director-

General of the Internal Audit Agency and/or the Auditor-General.

vi. Fraud perpetrated by other staff may be reported to the Vice-Chancellor before

being investigated, or investigated and reported to the Vice-Chancellor

depending on the nature of the matter and the extent to which the Vice-

Chancellor might want to protect the perpetrator.

3.19 Quality Assurance Improvement Programme

Purpose

This provides guidelines on implementing appropriate quality assurance improvements

to promote audit effectiveness and efficiency.

Policies

i. The Director of Internal Audit shall develop and maintain a Quality Assurance

and Improvement Programme that covers all aspects of the internal audit

activity.

ii. The Directorate shall institute both internal and external assessment for quality

assurance improvements.

29 | P a g e

iii. Internal assessments shall be conducted at least once every two years by a team

of faculty and staff of the University with sufficient knowledge of internal audit

practices.

iv. External assessments shall be conducted at least once every five years by a

qualified, independent assessor or assessment team from outside the University.

v. The Director of Internal Audit shall communicate the results of the quality

assurance and improvement assessment to the Vice-Chancellor, Council and/or

Audit Committee.

vi. An assessment report must include the following areas:

a) The scope and frequency of both the internal and external assessments.

b) The qualifications and independence of the assessor(s) or assessment team,

including potential conflicts of interest.

c) Conclusions of assessors.

d) Corrective action plans.

3.20 Pre-Auditing

Purpose

This provides guidelines for the conduct of pre-audits to promote value for money, cost

control, and to blockage of financial leakages.

Policies

i. The Directorate shall continue to be responsible for pre-audits until the

University transfers the function to the Finance Directorate.

ii. A record of all pre-auditing shall be maintained by the Pre-Audit Lead.

iii. All requests for pre-audit must be accompanied by the appropriate documents

and a Value Added Tax invoice (if applicable).

iv. The Pre-Audit team may employ physical verification.

v. A record of savings made as a result of objecting some requests shall be

maintained by the Pre-Audit Lead.

vi. The Directorate shall pursue an online pre-audit process for the University.

vii. Pre-audit shall be done with reference to the budget line on the request and

accompanied by the appropriate approvals and authorization.

30 | P a g e

3.21 Mentoring Services

Purpose

This provides guidelines for accepting an institutional mentee by the Directorate to

promote the image of the University.

Policies

i. A request for mentorship shall be in writing addressed to the Vice-Chancellor.

ii. The terms of the mentorship shall be developed by the Director of Internal Audit

and approved by the Vice-Chancellor.

iii. Appropriate fee may be charged if applicable.

iv. A report of the mentorship shall be submitted by the Director of Internal Audit

one month after the programme to the Vice-Chancellor and the head of the

mentee institution.

31 | P a g e

4 Appendices

4.1 Definition of Terminologies

Internal control audits determine whether the unit is conducting its financial and

business processes under an adequate system of internal control, as required by the

University Financial Regulations and Governance, Act 921, and best practice.

Compliance audits determine the adequacy of a unit's system(s) designed to ensure

compliance with University policies, procedures and external requirements. Audit

recommendations typically address the need for improvements in procedures and

controls intended to ensure compliance with applicable regulations.

Financial audits address the accounting for, and reporting of financial transactions,

including commitments, authorizations, receipt and disbursement of funds. The purpose

of this type of audit is to verify that sufficient controls exist over assets, liabilities,

revenues, and expenditures and that there are adequate controls over the acquisition and

use of resources.

Information technology (IT) audits address the internal control environment of

automated information processing systems and how people use those systems. IT audits

typically evaluate system input, output, and processing controls; backup and recovery

plans; system security; and computer facilities.

Operational audits examine the use of unit resources to evaluate whether those

resources are being used in the most efficient and effective ways to fulfill the unit's

mission and objectives. An operational audit can include elements of a compliance

audit, a financial audit, and an IT audit.

Investigative audits focus on alleged civil or criminal violations of state laws or

violations of University policies and procedures that may result in prosecution or

disciplinary action. Allegations of theft or misuse of University assets, white-collar

crime, and conflicts of interest are examples of issues addressed by investigative audits.

32 | P a g e

Consulting projects may range from formal engagements defined by written

agreements, to advisory activities, such as participating in standing or temporary

management committees, boards or project teams.

Accurate communications are free from errors and distortions and are faithful to the

underlying facts.

Objective communications are fair, impartial, and unbiased and are the result of a fair-

minded and balanced assessment of all relevant facts and circumstances.

Clear communications are easily understood and logical, avoiding unnecessary

technical language and providing all significant and relevant information.

Concise communications are to the point and avoid unnecessary elaboration,

superfluous detail, redundancy, and wordiness.

Constructive communications are helpful to the engagement client and the organization

and lead to improvements where needed.

Complete communications lack nothing that is essential to the target audience and

include all significant and relevant information and observations to support

recommendations and conclusions.

Timely communications are opportune and expedient, depending on the significance of

the issue, allowing management to take appropriate corrective action.

Confidential information is information of a proprietary or sensitive nature about the

University, its students, contracted agents, and employees

Quality assurance and improvement program is designed to enable an evaluation of

the internal audit activity’s conformance with the Standards and an evaluation of

whether internal auditors apply the Code of Ethics. The program also assesses the

efficiency and effectiveness of the internal audit activity and identifies opportunities for

improvement.

33 | P a g e

4.2 Templates

4.2.1 Audit Evidence or Procedure Documentation Form

University of Ghana

Internal Audit Directorate

Audit Procedures Documentation Form

Audit Objective:

Audit Scope:

Audit Lead:

Start Date of Fieldwork:

End Date of Fieldwork:

Step 1: Title

Procedure (s) Performed:

Result/Conclusion

Done By:

Reviewed By:

Date:

Step 2: Title

Procedure (s) Performed:

Result/Conclusion

Done By:

Reviewed By:

Date:

Step 3: Title

Procedure (s) Performed:

Result/Conclusion

Done By:

Reviewed By:

Date:

Step 4 to XXX: Title

Procedure (s) Performed:

Result/Conclusion

Done By:

Reviewed By:

Date:

Reviewed/ Remarks by

Director of Internal Audit:

Date:

34 | P a g e

4.2.2 Code of Secrecy

During the course of any job duties, staff of the Internal Audit Directorate

(IAD) may have access to information that is sensitive, non-public, or

protected by State Privacy Statutes. All information contained in audit work-

papers and audit reports or disclosed to audit staff is confidential. It is the

policy of the IAD not to disclose to anyone outside the University, the

contents of any audit work-papers, audit reports, or other information made

available by the University. I would not directly or indirectly communicate or

reveal to any person, any matter, which shall be brought under my

consideration or shall come to my knowledge in the discharge of my official

duties except as may be required for the discharge of my official duties or as

may be specially permitted by law.

I have received, read, and understood the Internal Audit Directorates’

confidentiality policy.

I understand that it is a condition of my employment to adhere to the

confidentiality policy, and that violation of this work rule may result in

disciplinary action including dismissal.

___________________ _____________________

Signature Date

Name of Staff:

___________________ _____________________

Signature Date

(Director of Internal Audit)

4.2.3 Competencies Review Form

Use soft version

4.2.4 Ethical Review Form

Use soft version

35 | P a g e

4.2.5 Audit Time Sheet

Use soft version

4.2.6 Audit Finalisation Checklist

University of Ghana

Internal Audit Directorate

Audit Finalisation Checklist

Title of Audit:

Audit Objective:

Audit Scope:

Audit Lead:

Area Response

Yes No Partial Remarks

Competency Test of each team member

Ethical review test of each team member

Audit Time sheet

All Audit Observation Forms

Terms of Reference

Minutes of Entry Conference

Minutes of Exit Conference

Copies of appropriate documents

Audit working papers are completed

Obtained copy of prior audit report

Obtained copy of prior audit files

Copy of Prior Audit Recommendation Implementation Report

Draft audit report has been issued and discussed with auditee

Appropriate recipients of the report have been included in the

distribution list

Audit Report signed

Report is free from errors and grammatical mistakes

Recommendations are appropriate

Management responses received

Reviews have been done

Audit conforms to the Audit Charter

Completed By:

Date:

Director of Internal Audit:

Date:

36 | P a g e

4.2.7 Audit Recommendation Implementation Status Form

No. Finding Recommendation Year/Title

of Audit

Status of

Implementation

Verified By

and Date

1

2

Xxx

Reviewed By: Date: